Russ Cox

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 11.2.5 macOS versions prior to 10.13.3 tvOS versions prior to 11.2.5 watchOS versions prior to 4.2.2 **Description** The issue involves the `Kernel` component and allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. **Recommendations** For iOS versions prior to 11.2.5, update to version 11.2.5 or later. For macOS versions prior to 10.13.3, update to version 10.13.3 or later. For tvOS versions prior to 11.2.5, update to version 11.2.5 or later. For watchOS versions prior to 4.2.2, update to version 4.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 11 macOS versions prior to 10.13 tvOS versions prior to 11 watchOS versions prior to 4 **Description** The issue involves the `libc` component and allows remote attackers to cause a denial of service via a crafted string that is mishandled by the `glob` function. This is related to errors in resource management, specifically resource consumption. **Recommendations** For iOS versions prior to 11, update to version 11 or later. For macOS versions prior to 10.13, update to version 10.13 or later. For tvOS versions prior to 11, update to version 11 or later. For watchOS versions prior to 4, update to version 4 or later.

**Name of the Vulnerable Software and Affected Versions** Apple Safari versions prior to 9.1 **Description** The issue is related to the incorrect handling of file expansion in the Downloads feature of Apple Safari, allowing remote attackers to cause a denial of service via a specially crafted web site. **Recommendations** For versions prior to 9.1, update to version 9.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** GNU Compiler Collection versions 4.2.0 through 4.3.0 **Description** The issue is related to the incorrect handling of the sum of a pointer and an integer as greater than or equal to the pointer without using casts. This might lead to the removal of length testing code intended as a protection mechanism against integer overflow and buffer overflow attacks. The vendor has determined that this compiler behavior is correct according to section 6.5.6 of the C99 standard. Exploitation of this issue could allow a remote attacker to cause a denial of service or other impact. **Recommendations** For GNU Compiler Collection versions 4.2.0 through 4.3.0, consider using casts when performing pointer and integer operations to avoid unintended removal of length testing code. As a temporary workaround, manually review code generated by the compiler to ensure that protection mechanisms against integer overflow and buffer overflow attacks are not removed. At the moment, there is no information about a newer version that contains a fix for this vulnerability.